Browser LabLD-SOC1-LAB-006Medium
Browser LabLD-SOC1-LAB-006Medium22 min
Four Services, One Problem
An EDR alert fired on WS-118 for 'unsigned binary registered as a service'. Four services were installed on this host in the last 24 hours. Three of them are routine. Your job is to say which is not, and to prove it from the evidence rather than from the name.
What you will be able to do
- Separate vendor persistence from attacker persistence
- Find the second persistence mechanism
- Recommend removal that actually removes the foothold
Windows SecurityIOC AnalysisNetwork AnalysisIncident TriageT1543.003 — Windows ServiceT1053.005 — Scheduled Task
Sign in to start this lab.
Sign in